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APPARATUS AND METHOD FOR PREVENTING DIGITAL MEDIA PIRACY 
Cross-Reference to Related Applications 

5 application Serial No. 60/353,076 fiJed January 29, 2002. 

BACKGROUND 

1. Field of Invention 

present invention is directed to a digital me dia piracy threat response system 
that protects digital media from unauthorized reproduction. 
10 2. Description of Related Art 

Ms _ invention is directed „ nkga or ^ ^ 

—on an. other medl , Mntea or ^ ^ _ a ^ ^ ^ 

nawo*. such as the tata*, or privately owned , ^ K , LAN) 

Abased — — services reIy heavi* on .he use of ^ _ 
13 *, to dehver vMeo and a^io « to „ . ^ ^ 

•he digW media are siored on a server and a cW^en, tnedia viewer is used to 
receive aud dispiay audio/video Ws as they are acmss a netwo* fc. the 

server, wihou, ^ the tnedia on dte cUent. in a downioad scenario, the ^ m ed,a 

» *^e„, piayhaca via . cli<M . raidm( ^ yjewr 0m rf ^ ^ ^ ^ 
both of these approaches is .he risk of ,he di^ media asse, bei „ E ^ by fte e „ d 
user and then redistributed against the asset owner's wishes. 
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In many cases, such media delivery systems rely upon an encryption scheme to 
protect against piracy, commonly referred to as Digital Rights Management (DRM). 
Under this scheme, digital media files are encrypted using a private key known only to 
the rights-holder or its authorized distributor. The digital media are delivered to the 
5 client and decrypted using a public key exchanged between the server and the client upon 
successful user authentication and authorization. Authentication/authorization is usually 
accompanied via some form of payment to the rights holder or distributor. This is usually 
sufficient to protect against unauthorized viewing of digital media files. 

There are a variety of mechanisms available to the would-be digital media pirate 

10 when faced with a DRM-only (or similar type encryption/watermark) protection scheme. 
In displaying the media, the client-side viewer first decrypts and then decodes the media 
(converts the media from digital to analog format) for presentation on analog devices. 
The result is a series of video frames presented to the user. DRM does not protect against 
copying the decoded video frames. In essence, once the content is decrypted and 

15 decoded, it is unprotected and available to be copied in digital or analog form. 

By the time the digital media is presented to the viewer, it has been fully 
uncompressed and displayed on the computer screen. This image is a bitmap in memory, 
and all timing and signals are available on the video card bus. It is possible to capture 
and record these signals off the feature connector on a video card. Once captured, a 

20 simple set of algorithms may be used to regenerate the original uncompressed movie, as 
presented by the media player. All that remains is to make a master for duplication. 
Figure 1 is a graphical illustration of a hypothetical digital path from the streaming 
computer to the final product of encoded Video-CD (VCD). As Figure 1 shows, digital 
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videotape. From there it is a small step to re-encode the movie via a computer 26 to be 
used as a master for a VCD 27, and then a CD-ROM burner for the small-scale pirate - or 
a CD Stamper for larger scale operations. The VCD has enjoyed wide popularity and is a 
widely accepted format within the Asian market, so much so that most DVD players now 
5 on the market play back VCD movies. 

The analog piracy problem has been faced by the video community before. With 
the introduction of DVD's it would have been possible to record good quality copies 
straight off the DVD using the analog output. This is defeated using digital watermarks 
or steganographically embedded data, which were initially introduced by companies such 
3 as Macro-vision to inhibit piracy of VHS recordings. A similar system could be 
implemented on scan converters to stop an analog recording such as the scenario of 
Figure 2, but this solution is impractical and may lead to more problems with normal uses 
of projection units and televisions. 
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SUMMARY OF THE INVENTION 
The present invention is directed to a digital verification and protection (W) 
system that intelligently prevents digital media piracy through methods of threat 
response, and mitigates the need for the post-breach forensic diagnostic process common 
5 in many traditional digital media protection systems. The preferred embodiments of the 
present invention aids in protection against the unauthorized copying of digital media that 
are delivered to personal computers (PC) or to television sets via set-top boxes (STB). 
Theinventionprotectsagainstpiracyinbomstreantingand fa . 

high-level terms, the preferred embodiments of the present invention, among other 
10 features,: 

a) Positively identifies a known piece of equipment, device, or software, and 
searches for digital or analog outputs or its equivalents; 

b) Permits digital media playback only to viewing or downloading equipment 
of devices of known and approved configurations; and 

15 c) Identifies equipment configuration changes in real-time and determine if 

such changes constitute a breach of security. 

It is an object of the present invention to provide protection against piracy of 
digital content by disallowing playback on devices that provide a mechanism by which 
the decrypted and decoded media may be copied. In a DVP system in accordance with 

20 the preferred embodiments of the present invention, a consumer who wishes to view or 
use digital content must gain permission before it may access or display digital media 
(notwithstanding the fact that the digital media may or may not be additionally protected 
with conventional anti-piracy measures such as DRM). A consumer may gain permission 
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to gain access to the digital content if, in accordance with the present invention, the 
consumer's hardware and software configuration or setup do not pose as threats (i.e., 
cannot be used to reproduce the digital content without authorization). Further, in 
accordance with the preferred embodiments of the present invention, upon detecting a 
5 change in configuration of the consumer's viewing or downloading setup, the delivery of 
digital content is automatically stopped and must regain permission to the digital media. 

It is another object of the present invention to maintain a database of device or 
software configuration information, such as peripherals and applications, that may be 
classified as either acceptable or unacceptable configurations of setups for a consumer to 
10 have prior to gaining permission to access digital content. Specifically, in accordance 
with a DVP system of the present invention, the database is used to determine if a 
particular device configuration poses a threat to the digital media that have been 
requested. For example, if a digital recording device is attached to the user's PC, then the 
present invention may be programmed to determine that a threat exists, and the request 
15 for digital media is denied. In the case an unknown configuration is detected, the 
database is updated, and a threat examination process is preferably carried out that result 
in an expansion of the system's ability to accurately detect and respond to potential 
threats. 

One advantage of the present invention is security of protected information, 
20 copyright information, and media services. Specifically, the present invention ensures 
that information is only sent to and can be accessed only by parties whose configuration 
and setup are approved by the owner of the digital content to be delivered. Furthermore, 
this system ensures that media may only be presented on devices approved by the asset 
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BRIEF DESCRIPTION OF THE DRAWINGS 
Figure 1 is an illustration of a possible path for digital content from a computer to 
encoded VCD; 

Figure 2 is an illustration of a possible recording or reproduction scheme using 
5 digital-to-analog converting devices; 

Figure 3 is an illustration of the architecture of a digital verification and 
protection ("DVP") system in accordance with the preferred embodiment of the present 
invention; 

Figure 4 is an illustration of the operating characteristics of a DVP system in 
1 0 accordance with the preferred embodiment of the present invention; 

Figure 5 is another illustration of the operating characteristics of a DVP system in 
accordance with the preferred embodiment of the present invention; 

Figure 6 is yet another illustration of the operating characteristics of a DVP 
system in accordance with the preferred embodiment of the present invention; 
15 Figure 7 is an illustration of the architecture of the DVP system in accordance 

with an alternative embodiment of the present invention; 

Figure 8 is an illustration of the architecture of the DVP system in accordance 
with another alternative embodiment of the present invention; 

Figure 9 is an illustration of a specific implementation of the DVP system in 
20 accordance with the preferred embodiment of the present invention; 

Figure 10 is an illustration of another specific implementation of the DVP system 
in accordance with the preferred embodiment of the present invention; 
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DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

The present invention is directed to an apparatus and method for protecting digital 
content from being pirated or otherwise reproduced without authorization. A DVP 
system in accordance with the preferred embodiments of the present invention make a 
5 risk decision based on the examination of a user's viewing equipment configuration at the 
beginning of streaming each digital content, such as a movie. Specifically, if the DVP 
system detects that the user's download or viewing equipment configuration includes a 
recording device, such as an active plug-in recording device on a computer or a VCR 
connected to a set top box, then the DVP may be directed to deny delivery of the digital 

10 content to the user. Additionally, the DVP system can be used to monitor the users 
equipment configuration during the entire download or viewing session, and can interrupt 
or stop the delivery of digital content if there is any change to the users equipment such 
as an addition of a recording device to the equipment configuration or setup. 

In accordance with the preferred embodiments, the DVP system uses heuristic 

15 algorithms to recognize a potential threat. The process begins when a client device first 
attempts to access digital media. At that time, DVP registers the client device's relevant 
hardware and software profile. In constructing this profile, the system searches for 
certain device and software "fingerprints" that are known to provide information 
necessary to make a threat determination. 

20 Having captured and registered a client device profile when the device is first 

encountered, the DVP system improves threat determination performance by comparing 
that client device's profile with the registered profile on subsequent occasions. The 
system then only goes through a full threat determination process when the current and 
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registered profiles are different in some wav Th- 
in some way. Tins provides an optimal user experience 

without sacrificing security in a significant manner. 

1* Preferred embodiments of the presen t invention wiU now be described with 
references to Figures 3-19. 

5 Figure 3 illustrates a DVP svote™ Qr ^;* + 

SyStem ^ te *ure m accordance with the preferred 
of .he presM ^ Spttffical , y _ fc Dvp syaem jn ^ 
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10 * ^ ' * * * TO - a„ y ofcer device ^ „ disphy digM 

For in^ . ^ clien , ^ my ^ a ^ ^ ^ ^ 

W-I clien, co„r puttrand adispIaymonitor 

H- DVP ^ „ ^ fc prefened ^ ^ ^ 

— — 32, which may be my ^ fc ^ fc ^ ^ ^ w 
■3 (such ^ ^ my ^ ^ ^ ^ ^ ^ 

signals for presentation; an application server 33, which coordinates download or viewing 
teones* from ^ clien , to to a ^ ^ ^ ^ ^ 

37, which stores device conflations or seflaps tha, are de,e»inod to „ ^ 
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3» repository server W 38 , which ^ ^ ^ ^ 

oonflguration,, and preferah, logs th e n.ge of soon . 
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conflgerahon venflcaflon client ("CVC") 31, which defcmflnos the device eonflgnraflon 
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or setup of an user, and provides the information to the CVS; and a digital rights 
management server ("DRM") 36, which authorizes requests for encrypted media and 
provides a decryption key. 

It should be noted that, while the various components described above are 
5 illustrated in Figure 3 as separate hardware devices, it is within the scope of the present 
invention to implement the above-described functions via various software 
implementation methods while sharing the same hardware resources. 

Figure 4 illustrates a typical operation schematic of a DVP system in accordance 
with the preferred embodiment of the present invention. Specifically, a consumer, using 

10 the client device 30, first requests permission from the content provider to access digital 
media, the request being routed through the CVC 31 that preferably resides within the 
client device or otherwise has access to the client device 30. Upon receiving the request, 
the CVC 31 obtains configuration or setup information from the client device 30, and 
forwards or causes the information to be forwarded to CVS 34 for examination and 

15 approval. Upon receiving the approval request from the CVC 31 or the client device 30, 
the CVS 34 retrieves or looks up from the SRC 37 a list of acceptable and unacceptable 
configuration(s) or setup(s) that have been pre-approved with a predetermined approval 
criteria. 

Upon receiving the list of acceptable/unacceptable configuration or setups, the 
20 CVS 34 compares the client device 30 configuration or setup against the retrieved or 
looked-up list of acceptable configuration(s) or setup(s). In the case that the CVS 34 
determines the client device 30 configuration or setup is acceptable, then the CVS 34 
notifies the CVC 3 1 that the request for digital content has been approved. Once the 
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CVC 3! receives a notice ta fc cvs M ^ fc ^ fe ^ ^ ^ 

request digital «, ft. fc cv c „ ^ fc ^ ^ 3 „ ^ ^ ^ 
has been approved. Thereafter, to ^ ^ w ^ fc ^ ^ ^ ^ 
media server 35, which then delivers the digit,! content to ^ media ^ 3J 
5 It shou,d be acted ft* i„ detect the olieM dev ice 30 configtnation, the CVC 

31 prefetab,y can also d«e* in addita to ha^, rf 
software, overeiding of Mansion measures, ripping haclced or "Me- DRM 

or e^rypta software, nsem ruling fflega, colons through what m -w 
"Trojan software- (which could be someftnng ,b M loois fc ,„ ^ ^ 

10 us reai,, apiece of ripping software). The DVP system in ^ fc 

embudhnen. prefenab ly can detect Trojan software and rog ue software prt^es though 
checking the "DLL Signature" of each process tha, is running. This is a bit hk. DNA 
testing. For example . piece offing soft^ „ c]maaeli2xd DLU 
and other processes. Jus, renaming ft as southing ete 0te Word or ^ 
.3 deceive DVP because it reoogmzes « the DLL signal of this proC ess tha, Cairns «o 
be Outiook or Word resembles a piece of ripping mt 0utIook „ Word 

In accordance with another embodiment of Ore present fav^ if ^ Dvp 
system is used in conjunction with a conventions, encryption or wa^ark security 
system, then additionai security measures can be taken. For instance, in Figure 4, the 

20 ^^-'-t-bedcHveredtoutemediaviewerjainancryptedfotm.afterwhichdte 
media viewer 32 must request a Hcense or audtorization Sum the DRM 36, which may 
determine a, Ota, time whether to grant authorization and dehver to the client device 30 
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the appropriate decryption key or other similar access means to view the delivered digital 
content 

In Figure 4, if the CVS 34 determines that the client device configuration or setup 
is not acceptable, then the CVS 34 notifies the CVC 31 that the request for digital content 
5 is denied. The CVC 3 1 in turn notifies the user, preferably via the media viewer 32, that 
the request for digital content is denied. In accordance with the preferred embodiment of 
the present invention, the DVP system can also display messages to the user explaining 
the reasons why the request for digital content was denied, such as pointing out a 
particular device or software connected to the client device that may pose as a threat to 
10 digital piracy. 

Finally, if the CVS 34 in Figure 4 determines that the client configuration or setup 
is not contained within the retrieved list of configuration and/or is otherwise unknown, 
then the CVS 34 proceeds to take the steps illustrated in Figure 6. Figure 6 illustrates the 
operation of the DVP system of the present invention in the event that the CVS 34 

15 encounters an unknown client device configuration or setup. In particular, the CVS 34 
sends the detected questionable client device configuration to the TRS 38 for update of 
database on unknown client device configurations, the data being able to be later (or 
concurrently) used by content providers to analyze for its threat to digital piracy. 

Meanwhile, the CVS 34 retrieves from the SRC 37 a list of potential threat 

20 responses that may be taken in response to the unknown client device configuration 
detected, such response options being preferably based upon the digital content requested 
and the geographical location of the requesting client device. The potential threat 
response to an unknown user client device configuration can be simply a denial of digital 
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Non-threatening Configuration is known to the SRC 37 and no threat is detected 

Threatening Configuration is known to the SRC 37 as a threat 

Unknown Configuration is unknown to the SRC 37 

As discussed previously, threat determination is variable based on a number of 
factors, including media owner, geographic region, and so on. In determining the 
response, the system takes into account all threat determination factors before 
determining if the condition is non-threatening, threatening, or unknown. 
5 As also previously addressed, it is important to note that while the devices and 

their functions are described as separate hardware modules for purposes of explaining the 
present invention is a clear manner, it is contemplated within the scope of the present 
invention that many of these functions can be embodied in different hardware or software 
implementations or schematics to provide the same functions and results. 
10 Figure 5 illustrates the operations of the DVP system in accordance with the 

present invention in the event that new hardware or software are introduced to the client 
device 30 during the download or delivery of digital content to the user. Specifically, if, 
while the media viewer 32 is displaying or otherwise delivering digital content to the 
client device, the CVC 31 detects a configuration change in the client device 30, when 
1 5 the CVC 31 preferably directs the media viewer 32 to halt the delivery of digital content. 
Additionally, the CVC 31 forwards the updated client device configuration to the CVS 
34, which then compares the updated client device 30 configuration to that of the 
retrieved list of acceptable/unacceptable configuration or setup from the SRC 37. 

If, upon examination of the CVS 34, the DVP system determines that updated 
20 client device 30 configuration is unacceptable, then the CVC 31 is directed to cause the 
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digital confcn, «^ ,„ terminate, ^ 10 ^ ^ clien( deviM ^ ^ _ rf 
such acton by to DVP system . ff ^ ^ „ fc ^ ^ ^ ^ 

configoranon is acceptable, „„„ fte cvc „ „ ^ ^ ^ fc ^ ^ 
to resume. „ to cvs 34 deteraines ^ ^ ^ ^ m 

Over ume, ft. complex* of the aiM deviM My ^ ^ 

the DVP sy^ ^ more aware of ^ ^ ^ ^ ^ 

menddy^eningdevices and soflware . fcDVF ^ b ^ ^ 

'« He DVP system may teams of ^ in a variay of ^ fc 

P-tate. >*en system rep0TB m ^ to fc ^ a ^ 

expert in ^ ie<aminaSoB ^ ^ fc ^ ^ ^ ^ ^ 

the resons tnrongn ^ ^ ^ daemitaion ^ ^ ^ 

«. DVP system ^ derstands „ fc ^ js ^ to ^ ^ ^ ^ 

1 5 oeterminanon fa fte ^ , ^ fa .^.^ ^ 

As new devices, and softwam become available ,„ consume*, ^ devioes „ 
examined by human «p ate or ^ ^ ^ 

dig*, pimcy and described ,„ the system ^ngh an adminisnranve insane. After^d 
•he system is able ,„ a^omaticany ^ ^ ^ ^ 

20 Aduttonauy, differ content owneis my ^ varying opWons ^ 

Chen, device cnnugumuon, For exampte, „, e content provider may rennire that rheir 
content be p„yed only „„ devi cns m io m tave video ^ ^ ^ 
connectors, v*i,e ano*er may nave no such restriction. Purther , it may be ^ ^ 
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media owner has different concerns regarding specific types of media (e.g., first-run 
movies), or may have different concerns based on geographic area. In anticipation of 
such circumstances, the system allows for varying threat profiles per media owner, per 
media item, and per geographic area. The DVP system of the present invention can be 
5 configured to adapt as new threat profiles are introduced. For example, in the future a 
content provider may perceive that a certain networking protocol poses a threat. In this 
circumstance, the DVP system is adapted to detect such network protocol and further 
protect that media owner's content according to the updated threat profile. 

In a DVP system in accordance with the preferred embodiment of the present 
10 invention, if the CVC 31, be it either hardware or software, is somehow tampered, 
disabled, or malfunctioning, either due to actions by the user or otherwise, then all digital 
content delivery request is preferably denied until the CVC operates correctly again. 

Again, the present invention has thus far been described in certain terms regarding 
server and network architecture. It should be noted however that the architectural 
15 specifics thus far described are merely illustrative, and should not be considered the sole 
instance of the invention. Rather, the DVP implementation may vary in many instances, 
especially relating to network and server architecture. Specifically, while the preferred 
embodiment of Figures 3-6 describe the various servers as being connected by a network, 
a specific instance of the DVP system may have two or more servers contained within the 
20 same physical computing device and communicating within that device rather than across 
a network. Figure 7 illustrates a DVP system in accordance with an alternative 
embodiment of the present invention. As shown, the CVS 34, SRC 37, and TRS 38 are 
all contained within the DVP server 70. Figure 8 illustrates another alternative 
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embodiment of the present invention whereby the media server 35 and DRM 36 are 
contained within the application server 33. 

It should also be noted that, while the primary purpose of the present invention is 
directed to protection against piracy or unauthorized reproduction of digital content, the 
5 present invention may also be used to specify minimum client device requirements for 
receiving certain digital content. For instance, some media owners may require that a 
client device must meet certain minimum specifications in terms of hardware, operating 
system, software, and so on. Often, such requirements stem from a concern over media 
Playback quality. For instance, a media owner may believe that devices will present their 
10 media with insufficient quality unless the devices have a CPU above some certain 
performance specification or have a particular graphics processing capability. In another 
example, the digital content provider may require that the client device be equipped with 
certain parental control measures before delivering digital content of adult nature. The 
core of present invention, the ability to determine a client device configuration and 
15 compare that configuration to acceptable configurations, is ideally suited to ensure that a 
device meets minimum specifications. In essence, some may view devices not meeting 
such minimum specifications as a threat to quality rather than security. 

Finally, the present invention is applicable not only to streaming and downloaded 
digital video, but also to digital audio. The invention is easily implemented to protect 
20 against digital music piracy. 

Figure 9 shows a specific implementation of a DVP system in accordance with 
the preferred embodiment of the present invention. Specifically, in this specific 
implementation, the client device is a PC or set-top box 90 running Microsoft Windows 
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operating system, and the consumer uses the Internet Explorer web browser to access a 
host web site that lists available digital content. The CVC is an ActiveX control 
embedded in a web page, interacting with the client device through the Microsoft WMI 
(Windows Management Instrumentation) interface. The media viewer is Windows 
5 Media Player, and the DRM server is Microsoft Media Rights Manager. The Application 
Server is a Microsoft IIS Web Server, and the CVS runs under IIS as a web service. The 
CVC and CVS communicate securely via SOAP (Simple Object Access Protocol). TRS 
and SRC are a Microsoft SQL Server 2000 database, under control of the CVS. In Figure 
9, the equivalent of a CVC 3 1 is the CV Control.dll 109, the equivalent application server 

10 33 is the DVP web server 108, the CVS 34 equivalent is the CVServices 106, and the 
TRS 38 and SRC 37 equivalent is the ThreatDB 104. 

Figure 10 is another illustration of a specific implementation of certain aspects of 
the preferred embodiment of the present invention. Specifically, Figure 10 illustrates a 
sequence diagram depicting the sequence of events that occur upon downloading the 

1 5 CVC as software to a user's computer. 

Figure 1 1 is yet another illustration of a specific implementation of certain aspects 
of the preferred embodiment of the present invention. Specifically, Figure 1 1 illustrates a 
sequence diagram depicting the sequence of events that occur when a host web site 
visitor elects to request and view the digital content. 

20 Figure 12 is yet another illustration of a specific implementation of certain aspects 

of the preferred embodiment of the present invention. Specifically, Figure 12 illustrates a 
sequence diagram depicting the sequence of events that occur when a user starts a new 
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process or connects a new device to the client device while viewing or using the digital 
content being delivered. 

Figure 13 illustrates a sequence diagram illustrating the basic web service security 
protocol. Specifically, a client requests some random data from the server, encrypts this 
5 data, and sends this data back to the server as a parameter with the business call. The 
server encrypts the data that it gave the client, compares the encrypted data returned by 
the client, and if the data matches, the server performs the actual business call. The 
password used to encrypt the data on both sides is exchanged out-of-band. The encrypted 
data is returned to the server in a base-64 encoded form so that it can be transported using 
10 a SOAP (Simple Object Access Protocol) string. The return value for the business 
function indicates if authentication fails. 

Figure 14 is an entity-relationship diagram depicting a specific implementation of 
the data scheme of the CVS 34 in accordance with the preferred embodiment of the 
present invention. It is important to note that Figure 14 is merely illustrative and that 
15 many alternative database scheme may be implemented in accordance with the preferred 
embodiment of the present invention. 

Figure 15 illustrates a packaging diagram depicting the typical system entities that 
may be used directly or indirectly by the CVC 31 in accordance with the preferred 
embodiment of the present invention . 
20 Figure 16 illustrates what can be publicly visible properties and methods of the 

CVC 3 1 in accordance with the preferred embodiment of the present invention. 
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Figure 17 illustrates a class diagram showing the methods used by CVS 34 to 
carry out its functions in accordance with the preferred embodiment of the present 
invention. 

Figure 18 shows an integration class diagram whereby a Java Script framework 
5 method that may be created by a web site host to integrate with the CVC 31 in 
accordance with the preferred embodiment of the present invention. 

Figure 19 illustrates an encryption diagram depicting the functionality exposed by 
the SNEncryptdll, which provides the SOAP challenge-Response security mechanism 
that may be used between the CVC 31 and the CVS 34 in accordance with the preferred 
1 0 embodiment of the present invention. 

It should be noted that the present invention might be embodied in forms other 
than the preferred embodiments described above without departing from the spirit or 
essential characteristics thereof. The preferred embodiments are therefore to be 
considered in all aspects as illustrative and not restrictive, and all changes or alternatives 
15 that fall within the meaning and range or equivalency of the claims are intended to be 
embraced within them. 
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WHAT WE CLAIM: 
1. 



A system for preventing unauthorized duplication of digital media content 
distributed over a communication networlc to a client device capable 
Playback of the digital media content, said system comprising; 
5 a media server for storing digital media content; and 

a configuration verification server for receiving from the client device the 
configuration data of said client device, said configuration data including system 
configuration information of said client device, 

wherein said common veiiflcatjon ^ ^ fc ^ ^ 
.0 of said dte devic, to detonnine whether m clim device „ fc ^ fc 

stored digital media content for playback, and 

wherein if said conflgumtion vesication server d. KminK ^ „ client ^ 
is auftorized to receive the stored digna! media contem, said conflgmation verification 
server ca^es ft. stored digit., media MMait „ te ^ fc ^ ^ ^ ^ 

1 5 client device for playback. 

2. The system of claim !, mrther comprising a criteria server for storing sets 
of pre-approved contignration data, wherein said configmation verification server 
compares the received conflation data against said se« of pre-approved configuration 
20 dam in order ,„ detennine whether fte chen, device is authorized to p.aybacic the stored 



digital media content. 
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3. The system of claim 1, further comprising a threat repository server for 
storing sets of unauthorized configuration data, wherein said configuration verification 
server compares the received configuration data against said sets of unauthorized 
configuration data in order to determine whether the client device is authorized to 

5 playback the stored digital media content. 

4. The system of claim 1, further comprising an application server that is 
operatively coupled to the client device and the media server for coordinating delivery of 
the stored digital media content from the media server to the client device. 

10 

5. The system of claim 1, wherein said client device includes means for 
detecting the configuration data of said client device and sending the detected 
configuration data to said configuration verification server. 



15 6. The system of claim 1, wherein the stored digital media content includes 

video files, and wherein said client device includes a media viewer for viewing said video 
files. 
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7- The system of claim 1, wherein, during the delivery of the stored digital 
media content to the client device, the configuration verification server periodically 
receives from the client device updated configuration data, wherein the conation 
verification server uses the received updated configuration data to determine whether the 
client device is still authorized to playback the stored digital media content, and wherein 
if the configuration verification server determines that the client device is no longer 
authorized to playback the stored digital media content, me configuration verification 
server causes the delivery of the stored digital media content to stop. 

«■ The system of claim 1, wherein the stored digital media content is 
delivered to the client device in encrypted format. 



9- The system of claim 8, further comprising means for providing to the 
client device a decryption key to be used to decrypt the digital media content mat is 
15 delivered to the client device in encrypted format. 



10 



ISDOCID: <WO 030W630A2J_> 



WO 03/065630 



PCT/SG02/00234 



26 



1 0. A method for preventing unauthorized duplication of digital media content 
, distributed over a communication network to a client device capable of performing 
playback of the digital media content, said method comprising the steps of: 
storing digital media content; 
5 receiving from the client device the configuration data of said client device, said 

configuration data including system configuration information of said client device; 

using the received configuration data of said client device, determining whether 
said client device is authorized to playback the stored digital media content; and 

causing the stored digital media content to be delivered to the client device for 
10 playback. 



1 1 . The method of claim 1 0, further comprising the steps of: 
storing sets of pre-approved configuration data; and 

comparing the received configuration data against said sets of pre-approved 
1 5 configuration data. 



1 2. The method of claim 1 0, further comprising the steps of: 
storing sets of unauthorized configuration data; and 

comparing the received configuration data against said sets of unauthorized 
20 configuration data. 



13. The method of claim 10, wherein the stored digital media content is 
delivered in encrypted format. 
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14 - The method of claim n * 

ctam 13, further co m p ris in g the step of providing a 

delivered m encrypted fonnat. 

5 

>5- ne methodl)fc|aini nw,^^^^ 

«. *. ^ h . ^ ^ to 
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16. A machine-readable medium containing a set of executable instructions 
for causing a computer to perform a method for preventing unauthorized duplication of 
digital media content distributed over a communication network to a client device 
capable of performing playback of the digital media content, said method comprising the 
5 steps of: 

storing digital media content; 

receiving from the client device the configuration data of said client device, said 
configuration data including system configuration information of said client device; 

using the received configuration data of said client device, determining whether 
10 said client device is authorized to playback the stored digital media content; and 

causing the stored digital media content to be delivered to the client device for 
playback. 



17. The machine-readable medium of claim 16, wherein said method further 
1 5 comprises the steps of: 

storing sets of pre-approved configuration data; and 

comparing the received configuration data against said sets of pre-approved 
configuration data. 



20 
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18. The machine-readable medium of claim 16, wherein said method further 
comprises the steps of: 

storing sets of unauthorized configuration data; and 

comparing the received configuration data against said sets of unauthorized 
5 configuration data 



19. The machine-readable medium of claim 16, wherein 
comprises of steps of: 



the method further 



encrypting the stored digital media content to be delivered 



10 and 



to the client device; 



providing to the client device a decryption for decrypting the 
digital media content 



encrypted stored 



20. The machine-readable medium of claim 16, wherein the method further 
1 5 comprises the steps of: 

during ^ of ^ ^ ^ ^ ^ ^ ^ ^ ^ 
receiving ftom the client deviee updated configuration data; 

using the received updated enaction date, assessing whether the client device 
is still authorized to playback the stored digital media content; and 
20 if the alien, device is assessed as no longer authorized to playback the steed 

digital media content, causing the delivery of ft. stored digital mania content to stop. 
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21. A system for preventing unauthorized duplication of digital media content 
distributed over a communication network to a client device capable of performing 
playback of the digital media content, said system comprising; 

storing means for storing digital media content; 
5 verification means for receiving from the client device the configuration data of 

said client device, said configuration data including system configuration information of 
said client device, 

wherein said verification means uses the received configuration data of said client 
device to determine whether said client device is authorized to receive the stored digital 

1 0 media content and 

wherein if said verification means determines that the client device is authorized 
to receive the stored digital media content, said verification means causes the stored 
digital media content to be delivered from the means to the client device for playback. 

15 22. The system of claim 21, further comprising means for storing sets of pre- 

approved configuration data, wherein said verification means compares the received 
configuration data against said sets of pre-approved configuration data in order to 
determine whether the client device is authorized to playback the stored digital media 
content. 

20 
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23. The systen, of data 21, fcft. Mnplisi „ g meaM fcr ^ ^ rf 
—zed ^ ^ wherei „ _ coinparK ^ ^ 

config^on data ^ m ^ of ^ ^ ^ ^ 

whether the cJimt device „ ^ , o p , aybact ^ djsM ^ 

5 content. 



10 



24. The system of cIailn 21 _ ^ ^ ^ ^ ^ 

stored digital media content »o m ^ ^ ^ „ fc ^ ^ 

25. He system „f cIaim 21 , ^ ^ ^ ^ ^ ^ ^ 
deteeong dae confix ^ of ^ cBeB ^ ^ ^ fc ^ 
confiscation dale ,o said cortignmdon verification senas. 



26- n. syaem of Cairn 2,, ^ fc aored ^ ^ ^ ^ 
.5 ^"^-.tad^^.,,,..^,,^ 



27. The system of elahn 2,, wherein said commonicarion nenvoric is the 
Internet. 



28. tt e system of eiata 2,, herein the »red digKa media eonten, is 
delivered to the client device in enctypted fonnat. 
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29. The system of claim 28, further comprising means for providing to the 
client device a decryption key to be used to decrypt the digital media content that is 
delivered to the client device in encrypted format. 

5 30. The system of claim 21, wherein, during the delivery of the stored digital 

media content to the client device, the verification means periodically receives from the 
client device updated configuration data, wherein the verification means uses the received 
updated configuration data to determine whether the client device is still authorized to 
playback the stored digital media content, and wherein if the verification means 
10 determines that the client device is no longer authorized to playback the stored digital 
media content, the verification means causes the delivery of the stored digital media 
content to stop. 

31. A machine-readable medium containing a set of executable instructions 
15 for causing a microprocessor of a client device to perform a method of digital media 
content playback, said digital media content being distributed from a content provider 
over a communication network, said method comprising the steps of: 

requesting from the content provider digital media content for playback; 
detecting the system configuration information of the client device; 
20 sending to the content provider the detected system configuration information; 

receiving from the content provider authorization to receive the requested digital 
media content for playback. 
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32. The m achi„e- re adabJe medium of claim 31, wherein the method further 
comprises the steps of: 

while receiving the requested digital media content for playback, periodically 
detecting updated system configuration information of the client device; and 
sending to the content provider the updated system configuratic 



ion information of 

the client device. 



33. The machine-readable median, of claim 31, herein the method fimher 
1 0 digital media content 

34. IT* tnaehi^-readaMe ntedtam „f data, 31, wherein the tneftod ftahe, 
compdsas the «ep of ^ me ^ of ^ fc ^ ^ ^ ^ 

playback. 

15 
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35. A system for distributing digital media content over a communication 
network to a client device capable of performing playback of the digital media content, 
said system comprising: 

distribution means for distributing digital media content over the communication 
5 network in encrypted format; 

verification means for receiving from the client device the configuration data of 
said client device, said configuration data including system configuration information of 
said client device, 

wherein said verification means uses the received configuration data of said client 
10 device to determine whether said client device is authorized to receive the distributed 
digital media content for playback, and 

wherein if said verification means determines that the client device is authorized 
to receive the distributed digital media content, said verification means provides to the 
client device a decryption key for decrypting the distributed digital media content for 
15 playback. 

36. The system of claim 35, further comprising means for storing sets of pre- 
approved configuration data, wherein said verification means compares the received 
configuration data against said sets of pre-approved configuration data in order to 
20 determine whether the client device is authorized to receive the distributed digital media 
content. 
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37. The system of claim 35, forther comprising means for storing sets of 
unauthorized configuration data, wherein said verification server compares the received 
configuration data against said sets of unauthorized configuration data in order to 
determine whether the client device is authorized to receive the distributed digital media 



content. 



38. The system of claim 35, wherein said client device includes means for 
detecting the configuration data of said client device and sending the detected 
configuration data to said verification means. 



10 



39. The system of claim 35, wherein, after a decryption is provided to the 
client device, the verification means periodically receives from the client device updated 
configuration data, wherein the verification means uses the received updated 
configuration data to determine whether the client device is still authorized to receive the 
15 distributed digital media content, and wherein if the verification means determines that 
the client device is no longer authorized to receive digital media content being 
distributed, the verification means causes the client device to halt its reception of the 
digital media content. 



20 40. The system of claim 35, wherein said communications network is the 

Internet. 
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41. A method for distributing digital media content over a communication 
network to a client device capable of performing playback of the digital media content, 
said method comprising the steps of: 

distributing digital media content over the communication network in encrypted 

5 format; 

receiving from the client device the configuration data of said client device, said 
configuration data including system configuration information of said client device; 

using the received configuration data of said client device, determining whether 
said client device is authorized to receive the distributed digital media content for 
10 playback; and 

providing to the client device a decryption key for decrypting the distributed 
digital media content if the client device is determined to be authorized to receive the 
distributed digital media content. 

15 42. The method of claim 41 , further comprising the steps of: 

storing sets of pre-approved configuration data; and 

comparing the received configuration data against said sets of pre-approved 
configuration data. 

20 43 . The method of claim 4 1 , further comprising the steps of: 

storing sets of unauthorized configuration data; and 

comparing the received configuration data against said sets of unauthorized 
configuration data. 
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44- The method of claim 41, further comprising the steps of: 
receiving from the client device updated configuration data; 
using the received updated configuration data, assessing whether the client device 
5 is still authorized to receive the distributed digital media content; and 

if the client device is assessed as no longer authorized to receive digital media 
content being distributed, stopping the distribution of the digital media content to the 



10 



client device 



Internet. 



45. The m «hod „ f ^ 41 , ^ ^ ^ fa 
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